login as any user by manipulating passportpostlogin parameters about gluu-passport

[yurem]

Fixed. Here is instruction how to deploy fix.

Now passport send to oxAuth endpoint signed JWT. After getting it script check JWT signature. Also in this update we remove one redundant step: /oxauth/auth/passport/passportpostlogin.htm -> /oxauth/postlogin Now passport sends data to /oxauth/postlogin directly.

[willow9886]

Which version of gluu are you testing with?

[SebastianTusk]

I'm using version 3.1.3. I do not see any newer changes that might mitigate the issue.
The problem is, that the communication with gluu-passport is performed via the client browser. I have a test case where I skip any requests to gluu-passport. Instead I am doing the following requests:

1. GET https://{{hostname}}/identity
   redirects to https://{{hostname}}/oxauth/auth/passport/passportlogin, inits session
2. POST https://{{hostname}}/oxauth/auth/passport/passportpostlogin
   send the "result" of gluu-passport to oxauth, the data is encoded with base64, userid, email, name can be freely changed, accessToken is a random number
3. POST https://{{hostname}}/oxauth/auth/passport/passportpostlogin
   send the loginForm data as passportpostlogin.xhtml does, use the same data as in request 2, "javax.faces.ViewState" can be retrieved from request 2

At no stage is anything about the passport authentication verified. The accessToken is never used. In my opinion the communication between gluu-passport and oxauth should not be handled via the client browser.